| @@ -1,5 +1,11 @@ | ||
| 1 | 1 | <?php |
| 2 | +/** | |
| 3 | + * Signature class file. | |
| 4 | + * | |
| 5 | + * @package Activitypub | |
| 6 | + */ | |
| 7 | + | |
| 2 | 8 | namespace Activitypub; |
| 3 | 9 | |
| 4 | 10 | use WP_Error; |
| 5 | 11 | use DateTime; |
| @@ -4,12 +10,12 @@ | ||
| 4 | 10 | use WP_Error; |
| 5 | 11 | use DateTime; |
| 6 | 12 | use DateTimeZone; |
| 7 | 13 | use WP_REST_Request; |
| 8 | -use Activitypub\Collection\Users; | |
| 14 | +use Activitypub\Collection\Actors; | |
| 9 | 15 | |
| 10 | 16 | /** |
| 11 | - * ActivityPub Signature Class | |
| 17 | + * ActivityPub Signature Class. | |
| 12 | 18 | * |
| 13 | 19 | * @author Matthias Pfefferle |
| 14 | 20 | * @author Django Doucet |
| 15 | 21 | */ |
| @@ -18,9 +24,9 @@ | ||
| 18 | 24 | /** |
| 19 | 25 | * Return the public key for a given user. |
| 20 | 26 | * |
| 21 | 27 | * @param int $user_id The WordPress User ID. |
| 22 | - * @param bool $force Force the generation of a new key pair. | |
| 28 | + * @param bool $force Optional. Force the generation of a new key pair. Default false. | |
| 23 | 29 | * |
| 24 | 30 | * @return mixed The public key. |
| 25 | 31 | */ |
| 26 | 32 | public static function get_public_key_for( $user_id, $force = false ) { |
| @@ -36,9 +42,9 @@ | ||
| 36 | 42 | /** |
| 37 | 43 | * Return the private key for a given user. |
| 38 | 44 | * |
| 39 | 45 | * @param int $user_id The WordPress User ID. |
| 40 | - * @param bool $force Force the generation of a new key pair. | |
| 46 | + * @param bool $force Optional. Force the generation of a new key pair. Default false. | |
| 41 | 47 | * |
| 42 | 48 | * @return mixed The private key. |
| 43 | 49 | */ |
| 44 | 50 | public static function get_private_key_for( $user_id, $force = false ) { |
| @@ -59,9 +65,9 @@ | ||
| 59 | 65 | * @return array The key pair. |
| 60 | 66 | */ |
| 61 | 67 | public static function get_keypair_for( $user_id ) { |
| 62 | 68 | $option_key = self::get_signature_options_key_for( $user_id ); |
| 63 | - $key_pair = \get_option( $option_key ); | |
| 69 | + $key_pair = \get_option( $option_key ); | |
| 64 | 70 | |
| 65 | 71 | if ( ! $key_pair ) { |
| 66 | 72 | $key_pair = self::generate_key_pair_for( $user_id ); |
| 67 | 73 | } |
| @@ -77,9 +83,9 @@ | ||
| 77 | 83 | * @return array The key pair. |
| 78 | 84 | */ |
| 79 | 85 | protected static function generate_key_pair_for( $user_id ) { |
| 80 | 86 | $option_key = self::get_signature_options_key_for( $user_id ); |
| 81 | - $key_pair = self::check_legacy_key_pair_for( $user_id ); | |
| 87 | + $key_pair = self::check_legacy_key_pair_for( $user_id ); | |
| 82 | 88 | |
| 83 | 89 | if ( $key_pair ) { |
| 84 | 90 | \add_option( $option_key, $key_pair ); |
| 85 | 91 | |
| @@ -86,21 +92,23 @@ | ||
| 86 | 92 | return $key_pair; |
| 87 | 93 | } |
| 88 | 94 | |
| 89 | 95 | $config = array( |
| 90 | - 'digest_alg' => 'sha512', | |
| 96 | + 'digest_alg' => 'sha512', | |
| 91 | 97 | 'private_key_bits' => 2048, |
| 92 | 98 | 'private_key_type' => \OPENSSL_KEYTYPE_RSA, |
| 93 | 99 | ); |
| 94 | 100 | |
| 95 | - $key = \openssl_pkey_new( $config ); | |
| 101 | + $key = \openssl_pkey_new( $config ); | |
| 96 | 102 | $priv_key = null; |
| 103 | + $detail = array(); | |
| 104 | + if ( $key ) { | |
| 105 | + \openssl_pkey_export( $key, $priv_key ); | |
| 97 | 106 | |
| 98 | - \openssl_pkey_export( $key, $priv_key ); | |
| 107 | + $detail = \openssl_pkey_get_details( $key ); | |
| 108 | + } | |
| 99 | 109 | |
| 100 | - $detail = \openssl_pkey_get_details( $key ); | |
| 101 | - | |
| 102 | - // check if keys are valid | |
| 110 | + // Check if keys are valid. | |
| 103 | 111 | if ( |
| 104 | 112 | empty( $priv_key ) || ! is_string( $priv_key ) || |
| 105 | 113 | ! isset( $detail['key'] ) || ! is_string( $detail['key'] ) |
| 106 | 114 | ) { |
| @@ -114,9 +122,9 @@ | ||
| 114 | 122 | 'private_key' => $priv_key, |
| 115 | 123 | 'public_key' => $detail['key'], |
| 116 | 124 | ); |
| 117 | 125 | |
| 118 | - // persist keys | |
| 126 | + // Persist keys. | |
| 119 | 127 | \add_option( $option_key, $key_pair ); |
| 120 | 128 | |
| 121 | 129 | return $key_pair; |
| 122 | 130 | } |
| @@ -132,9 +140,9 @@ | ||
| 132 | 140 | $id = $user_id; |
| 133 | 141 | |
| 134 | 142 | if ( $user_id > 0 ) { |
| 135 | 143 | $user = \get_userdata( $user_id ); |
| 136 | - // sanatize username because it could include spaces and special chars | |
| 144 | + // Sanitize username because it could include spaces and special chars. | |
| 137 | 145 | $id = sanitize_title( $user->user_login ); |
| 138 | 146 | } |
| 139 | 147 | |
| 140 | 148 | return 'activitypub_keypair_for_' . $id; |
| @@ -149,17 +157,17 @@ | ||
| 149 | 157 | */ |
| 150 | 158 | protected static function check_legacy_key_pair_for( $user_id ) { |
| 151 | 159 | switch ( $user_id ) { |
| 152 | 160 | case 0: |
| 153 | - $public_key = \get_option( 'activitypub_blog_user_public_key' ); | |
| 161 | + $public_key = \get_option( 'activitypub_blog_user_public_key' ); | |
| 154 | 162 | $private_key = \get_option( 'activitypub_blog_user_private_key' ); |
| 155 | 163 | break; |
| 156 | 164 | case -1: |
| 157 | - $public_key = \get_option( 'activitypub_application_user_public_key' ); | |
| 165 | + $public_key = \get_option( 'activitypub_application_user_public_key' ); | |
| 158 | 166 | $private_key = \get_option( 'activitypub_application_user_private_key' ); |
| 159 | 167 | break; |
| 160 | 168 | default: |
| 161 | - $public_key = \get_user_meta( $user_id, 'magic_sig_public_key', true ); | |
| 169 | + $public_key = \get_user_meta( $user_id, 'magic_sig_public_key', true ); | |
| 162 | 170 | $private_key = \get_user_meta( $user_id, 'magic_sig_private_key', true ); |
| 163 | 171 | break; |
| 164 | 172 | } |
| 165 | 173 | |
| @@ -173,20 +181,20 @@ | ||
| 173 | 181 | return false; |
| 174 | 182 | } |
| 175 | 183 | |
| 176 | 184 | /** |
| 177 | - * Generates the Signature for a HTTP Request | |
| 185 | + * Generates the Signature for an HTTP Request. | |
| 178 | 186 | * |
| 179 | 187 | * @param int $user_id The WordPress User ID. |
| 180 | 188 | * @param string $http_method The HTTP method. |
| 181 | 189 | * @param string $url The URL to send the request to. |
| 182 | 190 | * @param string $date The date the request is sent. |
| 183 | - * @param string $digest The digest of the request body. | |
| 191 | + * @param string $digest Optional. The digest of the request body. Default null. | |
| 184 | 192 | * |
| 185 | 193 | * @return string The signature. |
| 186 | 194 | */ |
| 187 | 195 | public static function generate_signature( $user_id, $http_method, $url, $date, $digest = null ) { |
| 188 | - $user = Users::get_by_id( $user_id ); | |
| 196 | + $user = Actors::get_by_id( $user_id ); | |
| 189 | 197 | $key = self::get_private_key_for( $user->get__id() ); |
| 190 | 198 | |
| 191 | 199 | $url_parts = \wp_parse_url( $url ); |
| 192 | 200 | |
| @@ -192,14 +200,14 @@ | ||
| 192 | 200 | |
| 193 | 201 | $host = $url_parts['host']; |
| 194 | 202 | $path = '/'; |
| 195 | 203 | |
| 196 | - // add path | |
| 204 | + // Add path. | |
| 197 | 205 | if ( ! empty( $url_parts['path'] ) ) { |
| 198 | 206 | $path = $url_parts['path']; |
| 199 | 207 | } |
| 200 | 208 | |
| 201 | - // add query | |
| 209 | + // Add query. | |
| 202 | 210 | if ( ! empty( $url_parts['query'] ) ) { |
| 203 | 211 | $path .= '?' . $url_parts['query']; |
| 204 | 212 | } |
| 205 | 213 | |
| @@ -212,11 +220,11 @@ | ||
| 212 | 220 | } |
| 213 | 221 | |
| 214 | 222 | $signature = null; |
| 215 | 223 | \openssl_sign( $signed_string, $signature, $key, \OPENSSL_ALGO_SHA256 ); |
| 216 | - $signature = \base64_encode( $signature ); // phpcs:ignore | |
| 224 | + $signature = \base64_encode( $signature ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode | |
| 217 | 225 | |
| 218 | - $key_id = $user->get_url() . '#main-key'; | |
| 226 | + $key_id = $user->get_id() . '#main-key'; | |
| 219 | 227 | |
| 220 | 228 | if ( ! empty( $digest ) ) { |
| 221 | 229 | return \sprintf( 'keyId="%s",algorithm="rsa-sha256",headers="(request-target) host date digest",signature="%s"', $key_id, $signature ); |
| 222 | 230 | } else { |
| @@ -228,13 +236,13 @@ | ||
| 228 | 236 | * Verifies the http signatures |
| 229 | 237 | * |
| 230 | 238 | * @param WP_REST_Request|array $request The request object or $_SERVER array. |
| 231 | 239 | * |
| 232 | - * @return mixed A boolean or WP_Error. | |
| 240 | + * @return bool|WP_Error A boolean or WP_Error. | |
| 233 | 241 | */ |
| 234 | 242 | public static function verify_http_signature( $request ) { |
| 235 | - if ( is_object( $request ) ) { // REST Request object | |
| 236 | - // check if route starts with "index.php" | |
| 243 | + if ( is_object( $request ) ) { // REST Request object. | |
| 244 | + // Check if route starts with "index.php". | |
| 237 | 245 | if ( str_starts_with( $request->get_route(), '/index.php' ) || ! rest_get_url_prefix() ) { |
| 238 | 246 | $route = $request->get_route(); |
| 239 | 247 | } else { |
| 240 | 248 | $route = '/' . rest_get_url_prefix() . '/' . ltrim( $request->get_route(), '/' ); |
| @@ -239,9 +247,9 @@ | ||
| 239 | 247 | } else { |
| 240 | 248 | $route = '/' . rest_get_url_prefix() . '/' . ltrim( $request->get_route(), '/' ); |
| 241 | 249 | } |
| 242 | 250 | |
| 243 | - // fix route for subdirectory installs | |
| 251 | + // Fix route for subdirectory installs. | |
| 244 | 252 | $path = \wp_parse_url( \get_home_url(), PHP_URL_PATH ); |
| 245 | 253 | |
| 246 | 254 | if ( \is_string( $path ) ) { |
| 247 | 255 | $path = trim( $path, '/' ); |
| @@ -250,13 +258,13 @@ | ||
| 250 | 258 | if ( $path ) { |
| 251 | 259 | $route = '/' . $path . $route; |
| 252 | 260 | } |
| 253 | 261 | |
| 254 | - $headers = $request->get_headers(); | |
| 262 | + $headers = $request->get_headers(); | |
| 255 | 263 | $headers['(request-target)'][0] = strtolower( $request->get_method() ) . ' ' . $route; |
| 256 | 264 | } else { |
| 257 | - $request = self::format_server_request( $request ); | |
| 258 | - $headers = $request['headers']; // $_SERVER array | |
| 265 | + $request = self::format_server_request( $request ); | |
| 266 | + $headers = $request['headers']; // $_SERVER array | |
| 259 | 267 | $headers['(request-target)'][0] = strtolower( $headers['request_method'][0] ) . ' ' . $headers['request_uri'][0]; |
| 260 | 268 | } |
| 261 | 269 | |
| 262 | 270 | if ( ! isset( $headers['signature'] ) ) { |
| @@ -312,9 +320,8 @@ | ||
| 312 | 320 | return $public_key; |
| 313 | 321 | } |
| 314 | 322 | |
| 315 | 323 | $verified = \openssl_verify( $signed_data, $signature_block['signature'], $public_key, $algorithm ) > 0; |
| 316 | - | |
| 317 | 324 | if ( ! $verified ) { |
| 318 | 325 | return new WP_Error( 'activitypub_signature', __( 'Invalid signature', 'activitypub' ), array( 'status' => 401 ) ); |
| 319 | 326 | } |
| 320 | 327 | return $verified; |
| @@ -320,16 +327,16 @@ | ||
| 320 | 327 | return $verified; |
| 321 | 328 | } |
| 322 | 329 | |
| 323 | 330 | /** |
| 324 | - * Get public key from key_id | |
| 331 | + * Get public key from key_id. | |
| 325 | 332 | * |
| 326 | 333 | * @param string $key_id The URL to the public key. |
| 327 | 334 | * |
| 328 | 335 | * @return WP_Error|string The public key or WP_Error. |
| 329 | 336 | */ |
| 330 | - public static function get_remote_key( $key_id ) { // phpcs:ignore | |
| 331 | - $actor = get_remote_metadata_by_actor( strip_fragment_from_url( $key_id ) ); // phpcs:ignore | |
| 337 | + public static function get_remote_key( $key_id ) { | |
| 338 | + $actor = get_remote_metadata_by_actor( strip_fragment_from_url( $key_id ) ); | |
| 332 | 339 | if ( \is_wp_error( $actor ) ) { |
| 333 | 340 | return new WP_Error( |
| 334 | 341 | 'activitypub_no_remote_profile_found', |
| 335 | 342 | __( 'No Profile found or Profile not accessible', 'activitypub' ), |
| @@ -336,9 +343,9 @@ | ||
| 336 | 343 | array( 'status' => 401 ) |
| 337 | 344 | ); |
| 338 | 345 | } |
| 339 | 346 | if ( isset( $actor['publicKey']['publicKeyPem'] ) ) { |
| 340 | - return \rtrim( $actor['publicKey']['publicKeyPem'] ); // phpcs:ignore | |
| 347 | + return \rtrim( $actor['publicKey']['publicKeyPem'] ); | |
| 341 | 348 | } |
| 342 | 349 | return new WP_Error( |
| 343 | 350 | 'activitypub_no_remote_key_found', |
| 344 | 351 | __( 'No Public-Key found', 'activitypub' ), |
| @@ -346,11 +353,11 @@ | ||
| 346 | 353 | ); |
| 347 | 354 | } |
| 348 | 355 | |
| 349 | 356 | /** |
| 350 | - * Gets the signature algorithm from the signature header | |
| 357 | + * Gets the signature algorithm from the signature header. | |
| 351 | 358 | * |
| 352 | - * @param array $signature_block | |
| 359 | + * @param array $signature_block The signature block. | |
| 353 | 360 | * |
| 354 | 361 | * @return string The signature algorithm. |
| 355 | 362 | */ |
| 356 | 363 | public static function get_signature_algorithm( $signature_block ) { |
| @@ -356,9 +363,9 @@ | ||
| 356 | 363 | public static function get_signature_algorithm( $signature_block ) { |
| 357 | 364 | if ( $signature_block['algorithm'] ) { |
| 358 | 365 | switch ( $signature_block['algorithm'] ) { |
| 359 | 366 | case 'rsa-sha-512': |
| 360 | - return 'sha512'; //hs2019 https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12 | |
| 367 | + return 'sha512'; // hs2019 https://datatracker.ietf.org/doc/html/draft-cavage-http-signatures-12. | |
| 361 | 368 | default: |
| 362 | 369 | return 'sha256'; |
| 363 | 370 | } |
| 364 | 371 | } |
| @@ -365,25 +372,25 @@ | ||
| 365 | 372 | return false; |
| 366 | 373 | } |
| 367 | 374 | |
| 368 | 375 | /** |
| 369 | - * Parses the Signature header | |
| 376 | + * Parses the Signature header. | |
| 370 | 377 | * |
| 371 | 378 | * @param string $signature The signature header. |
| 372 | 379 | * |
| 373 | - * @return array signature parts | |
| 380 | + * @return array Signature parts. | |
| 374 | 381 | */ |
| 375 | 382 | public static function parse_signature_header( $signature ) { |
| 376 | - $parsed_header = array(); | |
| 377 | - $matches = array(); | |
| 383 | + $parsed_header = array(); | |
| 384 | + $matches = array(); | |
| 378 | 385 | |
| 379 | 386 | if ( \preg_match( '/keyId="(.*?)"/ism', $signature, $matches ) ) { |
| 380 | 387 | $parsed_header['keyId'] = trim( $matches[1] ); |
| 381 | 388 | } |
| 382 | - if ( \preg_match( '/created=([0-9]*)/ism', $signature, $matches ) ) { | |
| 389 | + if ( \preg_match( '/created=["|\']*([0-9]*)["|\']*/ism', $signature, $matches ) ) { | |
| 383 | 390 | $parsed_header['(created)'] = trim( $matches[1] ); |
| 384 | 391 | } |
| 385 | - if ( \preg_match( '/expires=([0-9]*)/ism', $signature, $matches ) ) { | |
| 392 | + if ( \preg_match( '/expires=["|\']*([0-9]*)["|\']*/ism', $signature, $matches ) ) { | |
| 386 | 393 | $parsed_header['(expires)'] = trim( $matches[1] ); |
| 387 | 394 | } |
| 388 | 395 | if ( \preg_match( '/algorithm="(.*?)"/ism', $signature, $matches ) ) { |
| 389 | 396 | $parsed_header['algorithm'] = trim( $matches[1] ); |
| @@ -391,12 +398,16 @@ | ||
| 391 | 398 | if ( \preg_match( '/headers="(.*?)"/ism', $signature, $matches ) ) { |
| 392 | 399 | $parsed_header['headers'] = \explode( ' ', trim( $matches[1] ) ); |
| 393 | 400 | } |
| 394 | 401 | if ( \preg_match( '/signature="(.*?)"/ism', $signature, $matches ) ) { |
| 395 | - $parsed_header['signature'] = \base64_decode( preg_replace( '/\s+/', '', trim( $matches[1] ) ) ); // phpcs:ignore | |
| 402 | + $parsed_header['signature'] = \base64_decode( preg_replace( '/\s+/', '', trim( $matches[1] ) ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_decode | |
| 396 | 403 | } |
| 397 | 404 | |
| 398 | - if ( ( $parsed_header['signature'] ) && ( $parsed_header['algorithm'] ) && ( ! $parsed_header['headers'] ) ) { | |
| 405 | + if ( | |
| 406 | + ! empty( $parsed_header['signature'] ) && | |
| 407 | + ! empty( $parsed_header['algorithm'] ) && | |
| 408 | + empty( $parsed_header['headers'] ) | |
| 409 | + ) { | |
| 399 | 410 | $parsed_header['headers'] = array( 'date' ); |
| 400 | 411 | } |
| 401 | 412 | |
| 402 | 413 | return $parsed_header; |
| @@ -402,18 +413,19 @@ | ||
| 402 | 413 | return $parsed_header; |
| 403 | 414 | } |
| 404 | 415 | |
| 405 | 416 | /** |
| 406 | - * Gets the header data from the included pseudo headers | |
| 417 | + * Gets the header data from the included pseudo headers. | |
| 407 | 418 | * |
| 408 | 419 | * @param array $signed_headers The signed headers. |
| 409 | - * @param array $signature_block (pseudo-headers) | |
| 410 | - * @param array $headers (http headers) | |
| 420 | + * @param array $signature_block The signature block. | |
| 421 | + * @param array $headers The HTTP headers. | |
| 411 | 422 | * |
| 412 | 423 | * @return string signed headers for comparison |
| 413 | 424 | */ |
| 414 | 425 | public static function get_signed_data( $signed_headers, $signature_block, $headers ) { |
| 415 | 426 | $signed_data = ''; |
| 427 | + | |
| 416 | 428 | // This also verifies time-based values by returning false if any of these are out of range. |
| 417 | 429 | foreach ( $signed_headers as $header ) { |
| 418 | 430 | if ( 'host' === $header ) { |
| 419 | 431 | if ( isset( $headers['x_original_host'] ) ) { |
| @@ -430,39 +442,56 @@ | ||
| 430 | 442 | continue; |
| 431 | 443 | } |
| 432 | 444 | if ( '(created)' === $header ) { |
| 433 | 445 | if ( ! empty( $signature_block['(created)'] ) && \intval( $signature_block['(created)'] ) > \time() ) { |
| 434 | - // created in future | |
| 446 | + // Created in the future. | |
| 435 | 447 | return false; |
| 436 | 448 | } |
| 449 | + | |
| 450 | + if ( ! array_key_exists( '(created)', $headers ) ) { | |
| 451 | + $signed_data .= $header . ': ' . $signature_block['(created)'] . "\n"; | |
| 452 | + continue; | |
| 453 | + } | |
| 437 | 454 | } |
| 438 | 455 | if ( '(expires)' === $header ) { |
| 439 | 456 | if ( ! empty( $signature_block['(expires)'] ) && \intval( $signature_block['(expires)'] ) < \time() ) { |
| 440 | - // expired in past | |
| 457 | + // Expired in the past. | |
| 441 | 458 | return false; |
| 442 | 459 | } |
| 460 | + | |
| 461 | + if ( ! array_key_exists( '(expires)', $headers ) ) { | |
| 462 | + $signed_data .= $header . ': ' . $signature_block['(expires)'] . "\n"; | |
| 463 | + continue; | |
| 464 | + } | |
| 443 | 465 | } |
| 444 | 466 | if ( 'date' === $header ) { |
| 445 | - // allow a bit of leeway for misconfigured clocks. | |
| 467 | + if ( empty( $headers[ $header ][0] ) ) { | |
| 468 | + continue; | |
| 469 | + } | |
| 470 | + | |
| 471 | + // Allow a bit of leeway for misconfigured clocks. | |
| 446 | 472 | $d = new DateTime( $headers[ $header ][0] ); |
| 447 | 473 | $d->setTimeZone( new DateTimeZone( 'UTC' ) ); |
| 448 | 474 | $c = $d->format( 'U' ); |
| 449 | 475 | |
| 450 | - $dplus = time() + ( 3 * HOUR_IN_SECONDS ); | |
| 476 | + $dplus = time() + ( 3 * HOUR_IN_SECONDS ); | |
| 451 | 477 | $dminus = time() - ( 3 * HOUR_IN_SECONDS ); |
| 452 | 478 | |
| 453 | 479 | if ( $c > $dplus || $c < $dminus ) { |
| 454 | - // time out of range | |
| 480 | + // Time out of range. | |
| 455 | 481 | return false; |
| 456 | 482 | } |
| 457 | 483 | } |
| 458 | - $signed_data .= $header . ': ' . $headers[ $header ][0] . "\n"; | |
| 484 | + | |
| 485 | + if ( ! empty( $headers[ $header ][0] ) ) { | |
| 486 | + $signed_data .= $header . ': ' . $headers[ $header ][0] . "\n"; | |
| 487 | + } | |
| 459 | 488 | } |
| 460 | 489 | return \rtrim( $signed_data, "\n" ); |
| 461 | 490 | } |
| 462 | 491 | |
| 463 | 492 | /** |
| 464 | - * Generates the digest for a HTTP Request | |
| 493 | + * Generates the digest for an HTTP Request. | |
| 465 | 494 | * |
| 466 | 495 | * @param string $body The body of the request. |
| 467 | 496 | * |
| 468 | 497 | * @return string The digest. |
| @@ -467,17 +496,17 @@ | ||
| 467 | 496 | * |
| 468 | 497 | * @return string The digest. |
| 469 | 498 | */ |
| 470 | 499 | public static function generate_digest( $body ) { |
| 471 | - $digest = \base64_encode( \hash( 'sha256', $body, true ) ); // phpcs:ignore | |
| 500 | + $digest = \base64_encode( \hash( 'sha256', $body, true ) ); // phpcs:ignore WordPress.PHP.DiscouragedPHPFunctions.obfuscation_base64_encode | |
| 472 | 501 | return "SHA-256=$digest"; |
| 473 | 502 | } |
| 474 | 503 | |
| 475 | 504 | /** |
| 476 | 505 | * Formats the $_SERVER to resemble the WP_REST_REQUEST array, |
| 477 | - * for use with verify_http_signature() | |
| 506 | + * for use with verify_http_signature(). | |
| 478 | 507 | * |
| 479 | - * @param array $_SERVER The $_SERVER array. | |
| 508 | + * @param array $server The $_SERVER array. | |
| 480 | 509 | * |
| 481 | 510 | * @return array $request The formatted request array. |
| 482 | 511 | */ |
| 483 | 512 | public static function format_server_request( $server ) { |
| @@ -486,9 +515,9 @@ | ||
| 486 | 515 | $req_param = strtolower( $param_key ); |
| 487 | 516 | if ( 'REQUEST_URI' === $req_param ) { |
| 488 | 517 | $request['headers']['route'][] = $param_val; |
| 489 | 518 | } else { |
| 490 | - $header_key = str_replace( | |
| 519 | + $header_key = str_replace( | |
| 491 | 520 | 'http_', |
| 492 | 521 | '', |
| 493 | 522 | $req_param |
| 494 | 523 | ); |
